WalletConnect connector falls back to a hardcoded address 0x1234...: a mis-set flag yields a fake wallet

[nanaf6203-bit]

WalletConnect connector falls back to a hardcoded address 0x1234...: a mis-set flag yields a fake wallet

Labels / Complexity: Frontend · Trivial — Trivial

Summary

src/lib/walletConnectors/walletconnect.ts contains an E2E-test hook that returns a fabricated wallet when window.__MOCK_WALLETCONNECT__ is set:

if (typeof window !== 'undefined' && (window as any).__MOCK_WALLETCONNECT__) {
  const mockData = (window as any).__MOCK_WALLETCONNECT__;
  logger.debug('Using mock WalletConnect connection for E2E tests');
  return {
    address: mockData.address || '0x1234567890123456789012345678901234567890',
    chainId: mockData.chainId || 1,
  };
}

If that global is ever set in a production context (a stray snippet, an extension, or a leftover test shim), the app presents 0x1234... as the user's connected wallet. The mock bypasses the real provider entirely, so transactions could be signed against a phantom address with no warning. The fallback literal should not exist in the shipped bundle.

Proposal

• Remove the mock branch and hardcoded address, or gate it behind an explicit dev-only check (NODE_ENV !== 'production') with no fallback literal — mock data must be supplied or the real provider used.
• Keep the E2E path working via explicit test configuration if it is still needed.

Acceptance criteria

• No hardcoded wallet address fallback remains in src/lib/walletConnectors/walletconnect.ts.
• In production, __MOCK_WALLETCONNECT__ cannot yield a fake wallet address (test asserts the mock path is inert or absent in production builds).
• npm run lint and npm test pass.

Getting started

Files: src/lib/walletConnectors/walletconnect.ts (lines ~20-27). Commands: npm run lint, npm test. Pattern-match the mock gating style used elsewhere, e.g. src/config/mockConnector.ts.